Ensure cookies have the secure flag

Documentos > Code Analysis > Static Analysis Rules > Ensure cookies have the secure flag

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: csharp-security/cookie-http-only

Language: C#

Severity: Warning

Category: Security

CWE: 614

Description

Cookies must only be used for HTTP connections. Otherwise, client-side scripts can access cookies and compromise the user security.

Learn More

CWE-1004: Sensitive Cookie Without ‘HttpOnly’ Flag

Non-Compliant Code Examples

class MyClass {
    public static void setSecureCookie()
    {
        HttpCookie myCookie = new HttpCookie("my cookie");
        Console.WriteLine("Hello World");
        myCookie.HttpOnly = false;
    }
}

class MyClass {
    public static void setInsecureCookie()
    {
        HttpCookie myCookie = new HttpCookie("my cookie");
        Console.WriteLine("Hello World");
        myCookie.HttpOnly = false;
    }
}